Possible use after free in scsi_put_command()?

[Maurizio Lombardi <mlombard@xxxxxxxxxx>]

Hi Hannes,

I've a question regarding the asynchronous scsi abort handler,
look at the scsi_put_command() function:

void scsi_put_command(struct scsi_cmnd *cmd)
{
        unsigned long flags;
	[...]
        cancel_delayed_work(&cmd->abort_work);
        __scsi_put_command(cmd->device->host, cmd);
}

cancel_delayed_work() may return while the abort handler is still running,
the problem is that __scsi_put_command() frees the cmd pointer that
is still used by the abort handler.

Is it correct? Isn't safer to use cancel_delayed_work_sync() here?

Thanks,
Maurizio Lombardi

--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html